Description
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Google Chrome’s Extensions component has an authorization flaw that lets a remote attacker serve a crafted HTML page to bypass system access restrictions. The vulnerability is described as enabling remote code execution, indicating the potential for arbitrary code execution, even though the description only references a bypass of system access limits.

Affected Systems

All desktop installations of Google Chrome built before version 156.0.8078.47 are vulnerable. This includes Chromium‑based builds that ship on the stable channel. Versions equal to or newer than 156.0.8078.47 have the fix.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a social‑engineering step: a user opens or loads a malicious web page or link that contains the crafted content. No additional privileges beyond a standard web browser are needed to exploit the flaw.

Generated by OpenCVE AI on November 4, 2026 at 13:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 156.0.8078.47 or newer.
  • Disable or remove extensions from unknown or untrusted publishers, and restrict extension usage to essential applications.
  • Enable Chrome’s Safe Browsing, site isolation, and, where possible, enterprise extension installation policies to limit exposure to malicious extensions.

Generated by OpenCVE AI on November 4, 2026 at 13:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 13:45:00 +0000

Type Values Removed Values Added
Title Chrome Extension Input Validation Flaw Enabling Remote Code Execution

Wed, 04 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-863

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Chrome Extension Input Validation Flaw Enabling Remote Code Execution

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:38.248Z

Reserved: 2026-10-19T23:13:44.511Z

Link: CVE-2026-113264

cve-icon Vulnrichment

Updated: 2026-10-20T23:17:39.663Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:20.110

Modified: 2026-11-03T22:19:01.680

Link: CVE-2026-113264

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T13:30:16Z

Weaknesses